Known Limitations of Using Cisco ISE on AWS

[jitendrac]

Hi All,

It is mentioned in the documentation https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/install_guide/b_ise_InstallationGuide31/m_ISEaaS.html ISE in AWS has some known limitations. One known rule mentioned is that "The Amazon VPC supports only Layer 3 features. Cisco ISE nodes on AWS instances do not support Cisco ISE functions that depend on Layer 1 and Layer 2 capabilities. For example, working with DHCP SPAN profiler probes and CDP protocols that use the Cisco ISE CLI is not supported."

Can someone explain the meaning of this limitation? and can I get a list of ISE functions that will not work due to this limitation of Layer 1 and Layer 2 capabilities of AWS. 

I can think of Device Profiling is one function that may be affected ? Will it affect is any posture checks functions ? OR any 802.1x Authentication methods ?

[Arne Bier · Accepted solution]

What the documentation says about ISE CLI and CDP is that you won't see CDP neighbors in the ISE CLI. Fair enough - in my experience it doesn't work half of the time anyway. CDP runs on L2.

And ISE in AWS will work just fine for all RADIUS functionalities, since the RADIUS messages are UDP based (L4) and come to ISE via L3 (IP) transport. RADIUS functionality in AWS is identical with that of on-prem.

Other limitations/differences is that one can't SSH to the ISE CLI using username/password creds - you must use public/private keys. But that is also common in public cloud environments.